Extreme X440 specific intervlan configuration

[araan87]

Hello guys
i hope to find someone that could help me out, i'm new into networking , i've just got my Cisco CCNA certificate and i've received a request to configure 3 X440 , that seems to have different commands.
Ps. sorry for my english

my goal is :
1) rename the 3 switches (switch1-2-3) and connect them all using Trunk connection
2) create 4 vlans , and assign ports to the specific one (ex. vlan10, 20, 30, 40)
3) All the Vlan should be able to communicate with the Vlan 10 , but not with the other Vlan

Basically i'm stuck on the point n.3...

// rename the switch
config snmp sysName "switch1"

// configure Date & Time
config time (month/day/year/hour/minute/second)

// change psw for admin user
config account "administrator"
new password : xxxxxx

// create 4 vlan , add an IP for each interface
create Vlan n10 tag 10
create Vlan n20 tag 20
create Vlan n30 tag 30
create Vlan n40 tag 40

// add an IP address to each Vlan interface
configure vlan n10 ipaddress 192.168.10.1/24
configure vlan n20 ipaddress 192.168.20.1/24
configure vlan n30 ipaddress 192.168.30.1/24
configure vlan n40 ipaddress 192.168.40.1/24

// add ports to the specific vlan
configure vlan n10 add ports 2 - 20
configure vlan n20 add ports 21- 30
configure vlan n30 add ports 31 - 40
configure vlan n40 add portst 41 - 48

// configured port 1 (same for all the switches) as a trunk port
configure vlan n10 add port 1 tagged
configure vlan n20 add port 1 tagged
configure vlan n30 add port 1 tagged
configure vlan n40 add port 1 tagged

Now, just to be sure that the configuration made till this point was working, i've connected several devices to the ports of the switch and i've assigned a static IP to all of them , IP based on the Vlan:

• i can ping all the Vlan interfaces
• i can ping all devices inside the same vlan
• i cannot ping devices from different vlan
• configuring another switch with the same settings, i can communicate with same vlan , and not with another vlan

How can i setup the point n. 3) making all the vlan able to communicate only with n10 and n10 with all the other vlans ?

Kind regards
Daniele

[V3rash]

if you want to see if a devices is connected you can write this command

sh fdb | grep [@mac]

if your mac address appear after this command its that the level 2 is correct and in that case it s a pc problem not network problem except if this mac address does not passed on the good vlan

very useful command 

[FredrikB]

You're welcome! As so often in troubleshooting, it pays off to start from scratch, excluding nothing, even a patch cable, or, as in your case, software settings in the test device (PC).

Give it your best shot and post again if you're still seeing problems!

/Fredrik

[araan87]

According to all the tests that i ve made today, i ve isolated the issue and excluded the switch.
I have the same problem connecting 2 Pc direcrly with am ethernet cable.
I ve disabled the firewall but the issue still occur.
I ve contacted the technician that managed the network before i ve entered the company and he affirmed that there was a GPO that prevent ping from devices outside our network... 2 days hitting the wall with my head and the problem was totally somewhere else ?
Tomorrow i will try to remove this GPO , unconfigure all the 3 switches and i will configure them again using the commands that we've wrote on this thread, then i will add the ACL rules for the vlan isolation.
Thank you very much for all the help !

[FredrikB]

Hi!

It seems something else is weird, unlikely the switch. There is no command that would fix this issue because it really must be something else. Do the Windows (or Linux or whatever you use) have a software firewall that prevents the pings from reaching the other PCs?

Try this:

Connect all PCs to a VLAN, say v20
configure vlan n20 add ports 1-10 untagged (or similar)
Make sure no ACLs or policies are active in the switch.
On all PCs, ping all other PCs and the switch (192.168.20.1 or whatever VLAN you choose)
While still pinging, check the ARP tables on the PCs (arp -a in Windows, arp -n in Linux)

If you can see the ARP entries for all other PCs in all PCs, you at least have ARP traffic coming. If not... well, let's look at that then. In that case, connect PC1 to PC2 directly with a cable only (no switch in between) and try pingin between them. Go back to basic 🙂

Download and run Wireshark on all PCs (or use tcpdump in Linux CLI if you wish). You will see a lot of chatter when starting Wireshark, but mostly, that's the PC announcing stuff to other PCs, broadcasting its services (in Windows). Look for pings (excho request and replies). Do you see any?

/Fredrik